Malware is a type of software designed to take over and/or damage a computer user's operating system, without his or her knowledge or approval. Once installed on a user's computer, it is often very difficult to remove, and depending on the severity of the program installed, its effects can range in degree from minimal and annoying (e.g. unwanted pop up ads), to irreparable damage requiring the reformatting of the computer's hard drive, since much of malware is poorly written.
Malware attacks often compromise the ability to determine with certainty the identity of a software program and may be classified as different types for purposes of discussion herein. Other classifications are possible. For purposes of description, the true software program to which the identity belongs may be referred to as the program of interest. One type of attack is one in which an attacker attempts to stop the program of interest from executing. Stopping execution of the program of interest can be accomplished by crashing the program or an operating system on which the program is running by modifying the machine code to result in an invalid machine instruction or other fatal fault. Alternately, data associated with the program of interest could be modified, for example, to cause a segmentation fault by changing an array bound. As another alternative, the program could be unloaded from the process table of a task manager to prevent the program from being scheduled for execution.
Another type of attack involves the attacker modifying the program of interest to cause it to perform an operation other than what was originally intended for the program. For example, an attacker may use the compromised host system to execute code to propagate a worm, or code to perform a denial of service attack against a remote target. One way to cause the program of interest to perform an unintended operation is exploitation of an input buffer or stack overflow vulnerability.
Another type of attack involves tampering with the program of interest. Program tampering is demonstrated when an attack successfully modifies the program of interest and attempts to hide its modifications. Hiding its modifications can be considered a form of covering the attacker's tracks. An example of program tampering is an attack that modifies the program of interest, executes the modifications, and then removes the modifications to restore the program of interest to its original state.
Two specific types of malware are trojan horses and spyware. Trojan horses can erase or overwrite data on a computer, corrupt files, set up networks of zombie computers to launch denial of service attacks or send spam, log keystrokes to steal passwords and credit card numbers, and install a backdoor on computers. Spyware allows an attacker to spy on the user of a computer and secretly report information such as browsing habits to other people.
Certain types of malware, such as trojan horses and spyware, mentioned above, do not directly spread in the manner of a computer virus or worm. In other words, an infected system generally does not attempt to transmit the infection to other computers. Rather, this type of malware gets onto a host system by deceiving a user or through exploitation of software vulnerabilities. The most direct route by which this malware can get on a computer involves the user installing it. However, users are unlikely to install software if they know that it may disrupt their working environment and compromise their privacy. Thus, many malware programs deceive the user, either by piggybacking on a piece of desirable software, or by tricking the user into doing something that installs the software without the user realizing it. An example might be a user opening and/or saving an attachment sent in an email which appears to be a harmless file but actually contains malicious code. Once infected data is accessed by the host system, the infection can propogate to the entire system.
Methods and apparatuses for securely accessing data are disclosed. A host computer receives a request for data subject to digital rights management (DRM). In response to receiving the request a data security policy is determined for the requested data including determining an access level to the requested data for the requester. The host computer system determining whether to grant access to the requested data based at least in part on a credential of the requester.
In response to granting access to the requested data, the host computer system creates a secure virtual partition in which to execute a software application to enable the requester to access the data. The secure virtual partition is independent of any other operating system running on the host computer and isolated from any other partition on the host computer.
The host computer system performs an integrity check on a version of the software application and loads the integrity-verified version of the application into the secure virtual partition. The host computer system then provides access to the requested data via the application according to the determined access level of the requester.